Virus pls pomoc

[parecek]

Zdravim, lidi mám problém stáhl sem si z odkazu na youtubku cracknutej fraps, ale byl to nakej virus.A ted mi porad "saje" misto z disku:cry:

Nastesti to neni systemovej disk:bash:, staci abych neco smazal a dalsi den mi to zobrazi i o nekolik GB min, zkousel sem vsechny antivirusy ale nic, ten vir si asi hraje, a meni zobrazovanou kapacitu.PLS POMOZTE

predem dik

[Kamikaze211]

zkoušel jsi i antivirus avira? www.avira.com. Zkus a uvidíš ... Při nejhorším asi formát ..

[pigi96]

odpoj net zalohuj a format ;)

[Anonymous_]

http://www.viry.cz/forum/

.. kdyztak muzes i sem postnout log z hijackthis.. neni problem z toho logu zjistit, jestli ti bezi nejake srajdy, co bezet nemaji.

[parecek]

no takze sem zkusil ten antivir Avira ae nebere mi free key a platit se mi to nechce :D

asi si koupim 500 GB seagate(nechce se mi zalohovat celej disk[250GB]a znova to tam kopirovat, protoze nemam poradne kam :D) stejne casem bych si tu petistovku koupil...

to Anonymous_:thx vyzkousim to tam hodit :)

[_beriii_]

hod sem ten log z hijackthis ...

ten nam rekne vic...

a avira ma free edici tam se key nedava

tak buhvi co si tahal xD

kupovat disk kvuli viru xD

www.linux.cz a budes mit od viru pokoj "=D

[parecek]

xD tady je:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:18:12, on 21.10.2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Analog Devices\Core\smax4pnp.exe

D:\Program Files\Analog Devices\SoundMAX\Smax4.exe

D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

D:\WINDOWS\system32\RUNDLL32.EXE

D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

D:\PROGRA~1\Grisoft\AVG7\avgcc.exe

D:\WINDOWS\system32\rundll32.exe

D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

D:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

D:\Program Files\Messenger\msmsgs.exe

D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

D:\Program Files\DAEMON Tools Lite\daemon.exe

D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

D:\PROGRA~1\Grisoft\AVG7\avgemc.exe

D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Common Files\Teleca Shared\Generic.exe

D:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

D:\PROGRA~1\Grisoft\AVG7\avgw.exe

D:\WINDOWS\System32\svchost.exe

D:\Program Files\ICQ6\ICQ.exe

D:\Program Files\totalcmd\TOTALCMD.EXE

D:\Program Files\Internet Explorer\iexplore.exe

D:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy

O1 - Hosts: 87.229.102.30 l2authd.lineage2.com

O1 - Hosts: 87.229.102.30 l2testauthd.lineage2.com

O1 - Hosts: 216.107.250.194 nprotect.lineage2.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [soundMAXPnP] D:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] "D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [JMB36X Configure] D:\WINDOWS\system32\JMRaidTool.exe boot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [steam] "e:\program files\steam\steam.exe" -silent

O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219777499406

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{228B173A-F5DA-4A54-98C1-189A9D2AB767}: NameServer = 10.0.0.138

O17 - HKLM\System\CCS\Services\Tcpip\..\{5FDF30FC-CFD1-458A-B91D-5C07CA14CF9A}: NameServer = 10.0.0.138

O17 - HKLM\System\CCS\Services\Tcpip\..\{D68958EF-B6A9-4BEB-B7C1-B00D35FE5DDF}: NameServer = 10.0.0.138

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

--

End of file - 8547 bytes

[romeno]

Zkus tenhle programek : http://www.viry.cz/forum/viewtopic.php?t=40395

Kamos mel v kompu asi 3 trojany a tenhle je bezproblemu odstranil :D

Pozorne si precti navod , musi se spoustet v nouzovim rezimu...

[Anonymous_]

Hele, tak jsem ti ten log cely projel a zadny vir, ani podezrely soubor tam nemas.

Ale jedno ti rici muzu - je demence mit dva antiviry a dokonce mit u obou spustenou heuristickou analyzu! I NOD32 te pred tim pri instalaci varuje!

[parecek]

Hele, tak jsem ti ten log cely projel a zadny vir, ani podezrely soubor tam nemas.

Ale jedno ti rici muzu - je demence mit dva antiviry a dokonce mit u obou spustenou heuristickou analyzu! I NOD32 te pred tim pri instalaci varuje!

nn s AVG nepsal zadnej konflikt a zatim se to nijak neprojevuje :D:D

to romeno: jj dikes hned du nato :)

//EDIT: a jeste nevite jestli ten programek bude nejak fakat kdyz mam dva OS? otázka zní kdy přesně mačkat F8 :D

[Anonymous_]

To co pozorujes na PC je mozna zrovna ten konflikt..

A pokud hijack this nic neukazal a jsi si jisty, ze to plneni disku je chyba a neni to nejakym programkem (nebo treba swapovani ...), tak bych asi volil reinstall, protoze se taky muze jednat o rootkit.

F8 mackej ihned potom, co zacnes bootovat win xp.. Jakej mas boot loader? Grub? Tak hned jak klepnes na Windows XP. Vistackej? Tak hned (spolecne s tim) jak budes mackat Windows XP..

[parecek]

To co pozorujes na PC je mozna zrovna ten konflikt..

A pokud hijack this nic neukazal a jsi si jisty, ze to plneni disku je chyba a neni to nejakym programkem (nebo treba swapovani ...), tak bych asi volil reinstall, protoze se taky muze jednat o rootkit.

F8 mackej ihned potom, co zacnes bootovat win xp.. Jakej mas boot loader? Grub? Tak hned jak klepnes na Windows XP. Vistackej? Tak hned (spolecne s tim) jak budes mackat Windows XP..

normalni vistackej dik, nn ty 2 antiviry sem nainstaloval az po objeveni toho viru protoze sem skenoval disk.

projel sem to SDFixem ale nic, v reportu bylo, ze skenoval systemovej disk ne ten zavirovanej:? takze asi jedina moznost je format....

[parecek]

anonymous dluzim ti thanks diky za pomoc :)

myslim ze muzete lock